ir-playbook-privilege-escalation
De la autor
Incident-response playbook for privilege escalation on Linux and Windows — sudo/su abuse, SUID and capability misuse, kernel modules and exploits, sudoers/cron/systemd tampering, UAC bypass, admin-group changes and process injection; use when Wazuh raises escalation indicators (e.g. rules 5404, 5405, 5302, 80721, 92046, 92055, 60154) or a user gains unexpected root/SYSTEM.
Instalare
npx skills add gensecaihq/Wazuh-Autopilot --skill ir-playbook-privilege-escalation -a claude-code
Se instalează în .claude/skills/ir-playbook-privilege-escalation/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
- Folosește sudoScăzut
De ce 78
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- ir-playbook-suspicious-powershellgensecaihq/Wazuh-AutopilotIncident-response playbook for malicious PowerShell — encoded commands, download cradles, Office-spawned scripts, in-memory execution, credential dumping, Defender tampering and registry persistence; use when Wazuh raises PowerShell or Sysmon detections (e.g. rules 92057, 91809, 92047, 92008, 91844, 92024) on Windows hosts.Productivitate★ 60
- ir-playbook-bruteforcegensecaihq/Wazuh-AutopilotIncident-response playbook (PB-001) for brute-force, password-spraying and credential-stuffing attacks against SSH, PAM, Windows logon and web logins; use when Wazuh raises authentication-failure bursts (rule group authentication_failures, e.g. rules 5712, 5763, 60204) or a failure burst followed by a success (rule 40112).Altele★ 60
- ir-playbook-data-exfiltrationgensecaihq/Wazuh-AutopilotIncident-response playbook for suspected data exfiltration — archive staging, uploads to cloud storage, exfil over C2 or DNS, removable media and exposed cloud buckets; use when Wazuh flags staging or transfer indicators (e.g. rules 92212, 91846, 92038, 81101, 99548) or when volume/destination anomalies are reported. Most volume and DNS detections need custom rules — see section 1.Altele★ 60
- ir-playbook-vulnerability-spikegensecaihq/Wazuh-AutopilotIncident-response playbook (PB-005) for vulnerability spikes — sudden jumps in new CVE findings, the same CVE across many hosts, KEV-listed CVEs on exposed assets, SCA regressions, or exploitation attempts against vulnerable assets; use when Wazuh vulnerability-detector alerts surge (rules 23505, 23506) or web/IDS exploitation alerts (rules 31106, 31152, 86601) hit a known-vulnerable host.Securitate★ 60
- privilege-escalation-methodszebbern/claude-code-guideThis skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.Altele★ 4.7K
- ir-playbook-ransomwaregensecaihq/Wazuh-AutopilotIncident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, service stopping and log clearing; use when Wazuh shows FIM bursts (rules 550, 553, 554), antimalware detections (rules 62113, 87105), audit-log clearing (rule 60117) or recovery-inhibition commands. Containment within minutes.Productivitate★ 60
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te